1
0
mirror of https://gitlab.xiph.org/xiph/icecast-server.git synced 2024-12-04 14:46:30 -05:00
Commit Graph

20 Commits

Author SHA1 Message Date
Marvin Scholz
3a73f9c146 More hardening of XML output against invalid entities
This replaces the add node function with the one intended for text nodes
to prevent that invalid entities are not encoded and therefore could
break the XML output.

(See d739c65e54 and #2255)
2016-02-10 20:56:56 +01:00
Philipp Schafft
24bc25ec38 Cleanup: fixed some compiler warnings 2015-11-28 11:30:34 +00:00
Thomas B. Ruecker
671c2366cf Fixed log messages and comments
* Reworded many log messages for better understanding.
 * Adjusted some version targets as we won't have a 2.4.2 release.
 * Added some FIXME comments
2015-03-01 16:55:27 +00:00
Marvin Scholz
0dfc7c5b6a Cleanup codestyle
This commit cleanups codestyle a bit, yet there is still some work to be done
2015-01-25 19:57:27 +01:00
Philipp Schafft
11d5dffd49 Cleanup: Removed tailing spaces 2015-01-10 18:53:44 +00:00
Philipp Schafft
3d6ea2efdb Merged support for thread-less <role>s 2014-12-19 17:30:37 +00:00
Philipp Schafft
25f6c53929 Feature: immediate mode for <role>s
This allows a <role> represented by a auth_t to run in "immediate"
mode. In this mode no thread is created for this <role>. This is a
major speedup.

Closes #2124
2014-12-19 17:27:54 +00:00
Philipp Schafft
0eb466b76d Feature: Allow mangement of <role>s via admin/ interface.
This allows to manage <role>s via admin interface if the role supports.
Also format of admin/manageauth has been changed:
- <source> was renamed to <role>.
- mount parameter was removed.
- <role> got new parameters: type, name,
  can-adduser, can-deleteuser, can-listuser.
- can-* parameters are bools ("true" or "false"). They should be used
  to show or hide elements on the admin interface.

Ticket #2123 is nearly complet with this, just admin/manageauth.xsl
needs up be updated. Please close the bug in the commit that updates
admin/manageauth.xsl.
See #2123
2014-12-19 16:14:35 +00:00
Marvin Scholz
1bf41cfdb6 Epic Git migration commit
Added .gitignore and submodules
Changed paths to match new location of things
2014-12-02 22:50:57 +01:00
Philipp Schafft
93194594f7 better coding style, patch by ePirat. refs #2059
svn path=/icecast/trunk/icecast/; revision=19376
2014-11-30 20:32:30 +00:00
Philipp Schafft
a642cac542 Wow. Mega patch!
This patch *replaces* the authentication system completly.

What is new:
 - <authentication> in mount section is now a container object.
 - <authentication> in root and mount section may hold any number of <role>-Tags.
 - <role> tags:
   Those tags define a 'role' and it's ACL rules.
   A role is a instance of an authentication module (see below).
   <role> takes the following options. All but type are optional.
   - authentication related:
     - type: Type of the authentication module (values: anonymous, static, legacy-password, url or htpasswd;
             symbolic constants in auth.h)
     - name: Name for the role. For later matching. (values: any string; default: (none))
     - method: This rule is only active on the given list of HTTP methods.
               (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
   - ACL related:
     - allow-method: Allowed HTTP methods.
       (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: get)
     - deny-method: Rejected HTTP methods.
       (list of enum values: methods as recognized by httpp/ (e.g: get,post); default: *)
     - allow-admin: Allowed admin commands. (list of enum values: admin command; default: buildm3u)
     - deny-admin: Rejected admin commands. (list of enum values: admin command; default: *)
     - allow-web: Allowed web pages. (values: empty or *; default: *)
     - deny-web: Rejected web pages. (values: empty or *; default: (empty))
     - connections-per-user: maximum number of simultaneous connections per role and username.
       This is only active on active sources.  (values: unlimited or number of connections; default: unlimited)
     - connection-duration: maximum time of a connection. This is only active on active sources.
       (values: unlimited or number of secounds; default: unlimited)
   <role> takes <option> child tags. <option> tags contain a name and a value option.
   Meaning of <option> tags is up to the authentication module.
 - <role>s are considered to build a stack. If a role returns with AUTH_NOMATCH the next one will be tried.
 - <role>s are tested in this order: mount specific, default mount specific, global, internal fallback.
   Internal fallback is set to allow web/ access via GET, POST and HEAD (only GET supported by this time)
   and rejects all other requests.
 - New authentication module: anonymous
   This module matches all requests. No options taken.
 - New authentication module: static
   This module matches with a static username and password.
   It takes two <option>s. One with name="username" and one with name="password" to set username and password.
   This replaces old style <*-username> and <*-password> tags.
 - New authentication module: legacy-password
   This module matches with a statich password.
   It takes one <option> with name="password" to set password.
   This replaces old ICE and ICY (shoutcast compat mode) authentication.
 - Parsing <authentication> in <mount> with a type set in a special way to allow 100% backward compatibility.
 - Parsing of <source-password>, <admin-password>, <admin-user>, <relay-password> and <relay-user> in global
   <authentication> for 100% backward compatibility.
 - <alias> is now proccessed very early. This enables them to be used for all kinds of requests.

To Do List & What does not yet work:
 - type="url" auth: mount_add and mount_remove.
   This should be replaced by an unique feature I would call '<event>'.
 - Admin commands manageauth and manageauth.xsl are disabled as they need more review:
   This code needs to be ported to support multiple <role>s per <mount>.
 - url authentication module can not yet return AUTH_NOMATCH.
   This needs to be reviewed and discussed on how to handle this case best way.
 - Default config files needs to be updated to reflect the changes.
   As this is quite some political act it should be done in dicussion with the whole team
   and permission of the release manager.
 - Docs need to be updated to reflect the changes.

How does it work:
 Code has been changed so that authentification is done early for all clients.
 This allows accessing the ACL data (client->acl) from nearly everywhere in the code.

 After accept() and initial client setup the request is parsed. In the next step
 all <alias>es are resolved. After this the client is passed for authentication.
 After authentication it is passed to the corresponding subsystem depending on kind of request.

 All authentication instances have a thread running for doing the authentication.
 This thread works on a queue of clients.

Hints for testers:
 - Test with default config.
 - Test with diffrent authentication modules in <mount>.
 - Test shoutcast compatibility mode.
 - Test with new style <authentication> and any amount of <role> (zero to quite some).
 - Test <alias> lookup on all kinds of objects.
 - Test source level credential login into the admin interface.
 - Test shoucast style meta data updates.
 - Test playlist generation.

Thank you for reading this long commit message. Have fun reading the full patch!

svn path=/icecast/trunk/icecast/; revision=19358
2014-11-28 23:46:08 +00:00
Philipp Schafft
2b7cb1c641 LOG_{ERROR|WARN|INFO|DEBUG}() -> ICECAST_LOG_{ERROR|WARN|INFO|DEBUG}(); this is to avoid collision with LOG_INFO that is defined as part of syslog.
svn path=/icecast/trunk/icecast/; revision=19257
2014-10-31 08:46:58 +00:00
Philipp Schafft
7ae4664780 Replace the old logging macros with variadic argument macros. (patch by ePirat) (close #2058)
svn path=/icecast/trunk/icecast/; revision=19229
2014-10-09 10:39:13 +00:00
Philipp Schafft
98935fcc6e removed \r at end of lines
svn path=/icecast/trunk/icecast/; revision=18655
2012-10-12 14:41:12 +00:00
Karl Heyes
d503f0bf5c guard for 2 NULL pointer cases raised by coverity. Neither should occur in practice
svn path=/icecast/trunk/icecast/; revision=15358
2008-10-01 01:07:29 +00:00
Karl Heyes
2822e350bb htpasswd auth should apply even if no filename is specified, just reject all
new listeners with the reason logged. auth_t refcount was getting out of sync
which is a potential small memory leak.

svn path=/icecast/trunk/icecast/; revision=14788
2008-04-23 02:48:53 +00:00
Karl Heyes
4b5f00993d Allow for files to be specified that will contain IPs that can be used to
accept or deny client connections.

svn path=/icecast/trunk/icecast/; revision=14039
2007-10-23 22:25:31 +00:00
Karl Heyes
e065acb7f1 no functional/structural change but cleans up the annoying signed/unsigned pointer warnings
here with xmlChar, based on work originally done by gtgbr@gmx.net.
closes #783, #784, #785, #787

svn path=/icecast/trunk/icecast/; revision=13933
2007-10-04 16:48:38 +00:00
Michael Smith
0c6ba0c798 Fix bug reported by Jason@weatherserver.net - don't crash in htpasswd auth
if the auth file doesn't exist.

svn path=/icecast/trunk/icecast/; revision=9867
2005-08-30 20:29:20 +00:00
Karl Heyes
15b3a5f853 Initial auth merge. Add an auth thread (multiple threads can be done later)
which can be used to handle authentication mechanisms without taking locks
for long periods.  Non-authenticated mountpoints bypass the auth thread.

The lookup/checking of the source_t is done after the authentication succeeds
so the fallback mechanism does not affect which authenticator is used. This
can be extended to allow us to authenticate in webroot as well. XML re-read
changes will take effect immediately for new listeners but existing listeners
will use the original auth_t (refcounted) when they exit.

htpasswd access has been seperated out from auth.c, and implements an AVL
tree for a faster username lookup.  The htpasswd file timestamp is checked
just in case there are changes made externally

svn path=/icecast/trunk/icecast/; revision=9713
2005-08-07 23:01:04 +00:00